Re: filter application layer frames during capture kernel (SIP)

[Manolis Katsidoniotis <manoska () gmail com>]

Hello

Thanks.
Yes further to Guy's comment,
due to high traffic coming from servers which are faster than the capture
equipment,
I need to filter during capture otherwise
specific frames which I need are dropped
while others that I don't need are captured.

Thanks
Manolis

On Tue, Jan 23, 2018 at 11:43 AM Guy Harris <guy () alum mit edu> wrote:

> On Jan 23, 2018, at 5:31 AM, Dignam, Mark <Mark.Dignam () ee co uk> wrote:
>
> > Yeah in the filter option just add in sip contains XXXXXX (where XXXXXX
> is the MSISDN or part there of)
>
> That's a *display* filter, so it won't filter out packets during the
> capture process.
>
> Filtering specific SIP packets at capture time is much harder; see the
> ask.wireshark.com answer to which Anders pointed.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe